This is a discussion on Re: Negative ack slew, window scaling, ... within the IPFilter forums, part of the System Security and Security Related category; On Mon, Sep 29, 2003 at 09:36:05AM -0400, Victor.Duchovni@morganstanley.com wrote: > > No. An ack ...
|
|||||||
| FAQ | Members List | Calendar | Search | Today's Posts | Mark Forums Read |
|
|||
|
On Mon, Sep 29, 2003 at 09:36:05AM -0400, Victor.Duchovni@morganstanley.com wrote:
> > No. An ack can be circling around on the internet for some time. > > When the ack finally pops up, you can indeed safely ignore it, but it > > will lead to a blocked packet. So in order to not generate blocks if > > you do not need to, we set an arbitrary limit. > > > > Old packets have a *positive* ack slew. Negative ack slew is for ACKs that > are ahead of the highest seq+len from the other side. The reason this is > possible is that (apparently) the length only takes the first fragment > into account. Negative ack slew never gets more negative as the packet > ages (td_end never moves back). Negative ack slew should never exceed the > MSS (I think). Indeed. With fragments you just dont know the length of the total TCP or UDP packet beforehand. > The comment talks about why negative slew is allowed, but not about why it > is cumulative or about why it adjusts td_end instead of merely > compensating for the uncertainty elsewhere (by a allowing a fuzz of order > 1*MSS in the window). It is cumulative becausewhen you see one fragment, you will probably see more fragmented packets. You have to constantly correct for that. To be homnest, it is about 3-4 years ago I designed this. The paper should give a better answer ;-) -Guido |